Following the description in https://nightlies.apache.org/wicket/guide/9.x/single.html#_content_security_policy_csp all CSP rules are managed via Application settings (class ContentSecurityPolicySettings). This means it is not possible to add additional rules on the fly dynamically to the Content Security Settings class. For example, if a specific page within the Wicket application wants to add its own specific URL to the whitelist, this has to be done during the initializing phase of the application.
Is there a way to contribute or to add rules to the list of CSP directives (class CSPHeaderConfiguration) per component or page?
What would be the preferred way for doing that?
Thank you.
Using CSP rules per Page
Viewed 29
1 Answers
You can lookup the CSPHeaderConfiguration and modify it:
WebApplication.get().getCspSettings().getConfiguration().get(...).add(key, value)
The settings are evaluated dynamically, so you can add/remove at any time.
Related